Abstract: According to certain embodiments, an authentication method of an electronic device, comprises responsive to detecting an external electronic device using a first communication circuit, transmitting first data to the external electronic device using a second communication circuit; determining whether a response to the first data is received; and when the response to the first data is received from the external electronic device, performing communication connection and authentication procedures with the external electronic device.

Abstract: A system for real time federation of file permissions for digital content protection is described. The system automatically protects the files as the files leave application boundaries and then ensures that the files can only be used as per the permissions defined on those files while they were inside the application. The system also provides real time federation of policies with the application that generated the file and automatic protection of files as the files leave the application boundary. The system thus creates a single integral platform that is easy to access as well as reliable, and provides ease-of-use, advanced technology, and connectivity that delivers automated file protection.

Abstract: Systems and methods for managing data stream identity are provided. Ownership information regarding a data stream may be analyzed to identify at least one owner. The data stream may be filtered to identify at least one portion that is associated with the identified owner. A unique identifier may be assigned to the identified portion. The identified portion may be stored in memory in association with the assigned unique identifier and information regarding the identified owner. Access to the identified portion may be controlled based on settings set by the identified owner.

Abstract: A system for creating an identity mapping on a distributed ledger includes an interface and a processor. The interface is configured to receive a request to create an identity mapping on a distributed ledger. The processor is configured to generate an identity key pair; generate a mobile encryption key; encrypt a private identity key of the identity key pair using the mobile encryption key to create an encrypted private key; store the encrypted private key; create a mapping document; sign the mapping document with the private identity key of the identity key pair; and provide the signed mapping document to be stored in a distributed ledger.

Abstract: A system for credential authentication comprises an interface configured to receive a create indication to create a badge credential representing an employee badge and receive a claim indication from an authentication device to claim the badge credential, and a processor configured to provide the badge credential to the authentication device in response to the claim indication, receive a proof response from the authentication device comprising the badge credential and a lock identifier, validate the proof response using a distributed ledger, and provide a token for unlocking a lock associated with the lock identifier to the authentication device.

Abstract: A defense suite for an industrial control system (ICS) network is disclosed. The defense suite is installed and executed on a network server hosting the human-machine interface (HMI) function of the network, thereby gaining communication privileges of the HMI server to query and perform other operations with programmable logic controllers (PLCs) and other assets of the network. The defense suite further comprises a network protection engine (NWPE) that alerts a defense suite user of suspicious activity in the network. Normal behavior of the network is obtained by a learning engine, during a learning period. The learning engine can be reactivated after a configuration change in the network. The data suite also comprises an operating system protection engine (OSPE), for preventing removable devices from accessing the HMI server and a preventing execution of unauthorized executables. The OSPE is also trained for which programs are authorized through its own program discovery module.

Abstract: Embodiments of the present disclosure relate to a method for encryption and decryption, a programmable switch, and a computer program product. The method comprises receiving, at a programmable switch, encrypted data to be sent to a certain Internet of Things (IoT) device, wherein the encrypted data is encrypted using a public key of the programmable switch. The method further comprises decrypting the encrypted data using a private key of the programmable switch to obtain decrypted data, and then sending the decrypted data from the programmable switch to the IoT device. According to the embodiments of the present disclosure, the encryption and decryption operations of the IoT device can be transferred to the programmable switch for processing, and the programmable switch is used to help the IoT device perform encryption and decryption.

Abstract: A communication device stores a first secret key and a first public key, and the on-vehicle authentication device stores a second secret key, a second public key and a signature verification key. The on-vehicle authentication device acquires the first public key, verifies the authenticity of the electronic signature using a signature verification key, encrypts the second public key using the authentic first public key and transmits the encrypted second public key. The communication device receives the encrypted second public key, decrypts the encrypted second public key using the first secret key, encrypts the first public key using the decrypted second public key. The on-vehicle authentication device receives the encrypted first public key, decrypts the encrypted first public key using the second secret key, and authenticates that the communication device is an authentic device when the decrypted first public key has been determined to be authentic.

Abstract: Computerized methods and systems identify malware enabled by automatically generated domain names. An agent executes a malware, in a controlled environment, at a first temporal input value and a second temporal input value. A first set of domain names is generated in response to the execution at the first temporal input value. A second set of domain names is generated in response to the execution at the second temporal input value. The agent compares the first set of domain names with the second set of domain names to produce a comparison output metric.

Abstract: An information processing system includes: a first authentication unit that authenticates a user by a first method; a first providing unit that provides a service to the user authenticated by the first authentication unit; a second authentication unit that authenticates a user by a second method; and a second providing unit that provides a service to the user authenticated by the second authentication unit and also provides a service to the user authenticated by the first authentication unit in a case where the first method satisfies a condition determined according to the second method.

Abstract: A method for workload security rings that includes receiving a plurality of workloads, each associated with respective security criteria and scheduled for execution on a distributed computing system divided into a plurality of security rings each associated with a respective subset of computing devices of the distributed computing system that is physically isolated from the other security rings. For each respective workload, the method includes determining, using the respective security criteria, a security level of the respective workload and identifying, using the security level of the respective workload, one or more of the plurality of security rings that are eligible for executing the respective workload. The method also includes executing the respective workload on one or more computing devices selected from one of the respective subsets of computing devices associated with the identified one or more of the plurality of security rings eligible for executing the respective workload.

Abstract: The present disclosure provides a data processing method, a data processing device, and a computer readable storage medium. The data processing method includes: determining an encryption key according to first data; encrypting second data with the encryption key; and storing the first data in association with the encrypted second data.

Abstract: A method and apparatus for supporting security in a radio resource control (RRC) inactive state in a wireless communication system is provided. A user equipment (UE) receives information on multiple security variables, of which each variable is mapped to each of multiple counter values, respectively. The UE calculates a security parameter and/or updating a UE identifier (ID) based on a security variable among the security variables which is mapped to a corresponding counter value among the multiple counter values, and transmits a radio resource control (RRC) resume request message including the calculated security parameter and/or the updated UE ID. The counter value may be increase whenever a timer expires or an RRC reject message is received as a response to the RRC resume request message.

Abstract: Embodiments of the present disclosure provide a method and a device for cross-domain strong logically isolation and secure access control in the Internet of Things (IoT). The method includes the following. When one IoT gateway receives the identity authentication request, the IoT gateway sends the identity authentication request to all IoT gateways in the domain excluding that IoT gateway. When all IoT gateways in the domain receive the identity authentication request, all IoT gateways verify separately whether the identity authentication request is legal. After a certain IoT gateway obtains the identity authentication result, a distributed consensus procedure is initiated. The IoT gateways in the domain reach a consensus on the identity authentication result through a distributed consensus mechanism, and the identity authentication result is written and stored to a block of a blockchain.

Abstract: Methods, non-transitory computer readable media, network traffic manager apparatuses, and systems that assist with detecting changes to a firmware software components, and configuration parameters includes obtaining an executable file comprising a basic input-output system firmware and software component data of a hardware component at run-time. A hash value for the obtained executable file at the run-time is identified. The identified hash value is compared with a stored hash value associated with the obtained executable file to determine when the obtained executable file is unmodified, wherein the stored hash value was determined at a build time of the hardware component. The obtained executable file of the hardware component is executed when the obtained executable file is determined to be unmodified.

Abstract: A method of providing infrastructure protection for a network that includes IP addresses as low as a single IP address. An end user sends traffic to an IP address of a projected server publicly available as an anycast address, and sends traffic to the protected network. The traffic is routed via one of several scrubbing centers using the public IP address as anycast address, and the scrubbing center provides infrastructure protection by scanning and filtering the incoming traffic for illegitimate data. After filtering, the legitimate traffic is encapsulated, e.g., via including virtual GRE tunnel information that includes a secret IP address known only to the scrubbing center and the protected server that receives the network traffic. The protected server decapsulates the network packet and responds back to the end user via the scrubbing network.

Abstract: The system comprises an interface and a processor. The interface is configured to receive a request from an application for authorization to access, wherein access to the application is requested by a user, and receive a task request from the application for authorization to access a task, wherein access to the task is requested by the user. The processor is configured to authenticate the request from the application for authorization to access, determine that the task comprises a sensitive task, determine a user authentication device, provide a challenge for a digital credential to the user authentication device, wherein the digital credential is backed by data stored in a distributed ledger, receive a response from the user authentication device, determine the response is valid, and provide an authorization to access the sensitive task.

Abstract: One or more embodiments described herein disclose methods and systems that are directed at providing enhanced privacy, efficiency and security to distributed ledger-based networks (DLNs) via the implementation of zero-knowledge proofs (ZKPs) in the DLNs. ZKPs allow participants of DLNs to make statements on the DLNs about some private information and to prove the truth of the information without having to necessarily reveal the private information publicly. As such, the disclosed methods and systems directed at the ZKP-enabled DLNs provide privacy and efficiency to participants of the DLNs while still allowing the DLNs to remain as consensus-based networks.

Abstract: The system for credential authentication comprises an interface and a processor. The interface is configured to receive a request from an application for authorization to access, wherein access to the application is requested by a user using a user device. The processor is configured to provide a login request to the user; validate a login response; determine a user authentication device based on the login response; provide a proof request to the user authentication device; receive a proof response; determine that the proof response is valid using a distributed ledger; generate a token; and provide the token to the application authorizing access for the user.

Abstract: Systems and methods are provided for verifying identities of users. One exemplary method includes generating a unique identifier (ID) for a user, generating a public/private key pair associated with the unique ID for the user, and receiving at least two images. The images include a first image associated with a physical document indicative of an identity of the user and a second image comprising an image of at least part of the user. The exemplary method further includes validating an integrity of the first image, converting at least the first image to one-way hashed data, when the integrity of the first image is valid, and transmitting the hashed data signed with the private key, the unique ID and the public key to an identification provider, whereby a digital identity record for the user is stored in a ledger data structure.